connect.8x8.com: Deserialization Vulnerability in Automation Builder via Jint→Newtonsoft serializer coercion (TypeNameHandling)

Summary

@kyotozzx reported a deserialization vulnerability in the 8x8 Connect Automation Builder's HTTP request step. The vulnerability occurred when server-side template evaluation exposed Newtonsoft JSON objects directly to the Jint JavaScript engine. By providing a specially crafted JSON response, an authenticated user could coerce Jint's overload resolution to construct a JsonSerializer with attacker-controlled TypeNameHandling settings, enabling deserialization of arbitrary .NET types including System.Diagnostics.Process.

The issue was quickly addressed by projecting HTTP responses to plain JavaScript values (System.Dynamic.ExpandoObject) before template evaluation, removing all Newtonsoft object exposure from the template scope.

We thank @kyotozzx for submitting this report to us.